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In this letter, first, we investigate the security of a continuous-variable quantum cryptographic 
scheme with a postselection process against individual beam splitting attack. It is shown that the 
scheme can be secure in the presence of the transmission loss owing to the postselection. Second, 
we provide a loss limit for continuous-variable quantum cryptography using coherent states taking 
into account excess Gaussian noise on quadrature distribution. Since the excess noise is reduced by 
the loss mechanism, a realistic intercept-resend attack which makes a Gaussian mixture of coherent 
states gives a loss limit in the presence of any excess Gaussian noise. 



The security of quantum cryptography is degraded by 
the presence of realistic experimental imperfections. In 
particular the transmission loss limits the performance of 
schemes for a long distance transmission 'l'. 

Recently several continuous- variable quantum crypto- 
graphic schemes have been proposed 0,SSIEIEI3jIEI3- 
Those are sorted into either all-continuous type or hybrid 
type Q, the all-continuous scheme distributes a contin- 
uous key and the hybrid scheme distributes a discrete 
key. A loss limit, in the sense that the mutual infor- 
mation between Alice and Bob Iab cannot be greater 
than the Shannon information of an Eavesdropper (Eve) 
Ie^ is given for an all-continuous scheme [g and it is 
shown that this limitation can be removed by introduc- 
ing a postselection process for a hybrid scheme 0, H, 13 • 
The existence of loss limit is an open question. 

The reliable security measure for discrete quantum 
cryptographic schemes against individual attacks is the 
secure key gain G which ensures that Ie can be arbitrar- 
ily small in the long key limit if G is positive The 
question is how high G can be for a given loss or trans- 
mission distance in realistic conditions. The estimations 
are given for BB84 protocol Hll . entangled photon pro- 
tocol , and B92 protocol |l3j| . The estimation of G for 
continuous schemes, if possible, is important as a com- 
parison with discrete schemes. At least, the framework 
|14.ll5| can be adapted to hybrid schemes. 

For these discrete schemes, the experimental imper- 
fections are mostly determined by observed bit error 
rate and dark count rate of single photon detectors 
[Til IT^ ll^. In continuous- variable schemes, the exper- 
imental imperfections appear as the change of quadra- 
ture distributions. Experimentally, quadrature measure- 
ment is performed slightly above the standard quantum 
limit and observed quadrature distribution has additional 
Gaussian noise upon the minimum uncertainty Gaussian 
wavepacket |8|. Thus, the security analysis including ex- 
perimental imperfections seems to become qualitatively 
different from that of the discrete schemes. 



In our previous work [^ we estimated G of a hybrid 
type scheme applying a postselection [^ for a given loss, 
provided Eve performs quadrature measurement for the 
lost part of the signal. In this case it is shown that G 
can be positive if the loss is less than unity by setting a 
large postselection threshold. 

In this letter, firstly we estimate G of this scheme Isf for 
a given loss against individual beam splitting attack 
that is. Eve can use a positive operator valued measure 
(POVM) on the individual split signal independently. It 
is shown that G can be positive by setting a large thresh- 
old and there is no loss limit. Secondly we provide two 
concrete examples of eavesdropping attack which causes 
excess Gaussian noise. The first one is treated as an 
extension of individual beam splitting attack and it also 
shows no loss limit. The second one is an intercept-resend 
attack. It imposes a practical loss limit on every coherent 
state scheme. 

The protocol we study here is a four state protocol 
using phase modulation of weak coherent pulse and bal- 
anced homodyne detection applying a postselection pro- 
cess [^ 13 . Alice randomly chooses one of the four coher- 
ent states |-\/ne*""^/^) with the pulse intensity (the mean 
photon number per pulse) n > 0, m = 0, 1, 2, 3 and sends 
it to Bob. Then Bob randomly measures one of the two 
quadratures Xk with fc = 1,2 and [a;i,a;2] = ^. After the 
transmission of a large number of pulses, Alice transmits 
the parity of m to Bob through a classical channel. For 
the pulses m — k = ±1, Bob sets a threshold a;o(> 0) and 
constructs his bit sequence by the following decision: 



(bit value) 



1 \i X > Xf) 
if a; < — Xq, 



(1) 
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where x is the result of Bob's measurement. This is a 
postselection process and the advantage is that Bob can 
obtain arbitrarily small bit error rate by setting a larger 
threshold in the absence of obvious eavesdropping 
For simplicity, hereafter we set fc = 1. This does not 
change the results of following discussion. 

The lossy channel is modeled by a beam splitter (see 
Fig. nj and the split signal is assumed to be received by 
Eve. Bob receives the signal |y/?7ne*""^/^), where (0 < 
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?7 < 1) is the parameter characterizing the loss 1 — rj. 
If m — fc = ±1, the probabiUty that Bob's quadrature 
measurement results x is given by 0: 



FIG. 1; In a lossy channel, the input coherent state \a) is 
simply amplitude-damped as \^a) by the loss l — rj. In beam 
splitting attacli, Eve replaces the lossy transmission path with 
her lossless one and uses a beam splitter (BS) with the reflec- 
tivity 1 — rj, which corresponds to the original transmission 
loss. Then Eve can obtain the lost part of the signal j-^l — rjo) 
without causing any further disturbance to Bob's signal. 
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where {x\\ denotes the eigenbra of xi and (Ax)^ — j 
is the quadrature variance of coherent state. Using this 
probability, Bob's Shannon information gain per pulse is 
given by (l^: 



i ^ Prob(a;)iAB(a;,??n), 



(3) 



|a:|>a;o 



where the factor 1/2 is the probability that the basis is 
correct, i.e., Bob's choice of k satisfies m — k = ±1, and 



iAB{x,n) = 1 + Prob(-yn|a:^) log2 Prob(v^|a;) 

+ Prob(— log2 Prob(— v^l^;) (4) 

is the Shannon information gain when x is triggered, 
where 



Prob(-yn|a:^i) 



\{x,\^)f + \{x,\-^)\^ 



1 + exp 



(5) 



is the conditional probability that the state is |Vn) when 
the measurement results xi. 

Now we evaluate the potentially leaked information 
to Eve in the sense of Renyi [l^. For the individual 
atta cks, useful forms of Ren yi i nformation are known 
[T3. IT5I IT^ . According to [Tsj. for any binary pure 



states signal l^*-)}, the maximum Renyi informa- 

tion gain is given by 

/fp,=log2(2-|(vI/+|vI;_)|2). (6) 

Since Eve can perform her measurement after she 
learns the parity of m, the problem is to find the maxi- 
mum value of the Renyi information using a POVM on 
the binary signal {|-\/(l — rj)n), \ — ^(1 — ?7)ri)}. Thus 
substituting \^±) 
obtain 



Ioptin,v) = log; 



I ± - ri)n) into Eq. ®, we 
(1 — 'i])n 



exp 
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Using expressions © and {T)) we obtain the secure key 
gain (with ideal error correction) |9lllll|: 

G{xo,n,T]) = ^ Pi'ob(2;)(iAi3(a;,?7n) - /^j(n,?7)) 

\x\>xo 

= PToh{x){iABix,rin) - ll^^t{n,r])),{S) 

X>Xo 

where in the last expression we have used the properties, 
Prob(a;) = Prob(— x) and iABix,n) = iAB{—x,n). Thus 
we will discuss taking a; > in what follows. 

Since, for given positive n, < ij^^ < 1 and Iab 
is a monotonically increasing function of x > with 
lim2,_,oo lAB = 1, we can find x which satisfies 



iAB{x,rin) - /^t(ri,?7) > 0. 



(9) 



3 



From this inequality and expression © with Prob(x) > 
0, the choice of the threshold Xq > x gives G > 0. 

To obtain the maximum gain for a given r/, n and xq 
should be optimized simultaneously. A result of simulta- 
neous optimization is shown in Fig. |2| 
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FIG. 2: The secure key gain G is shown for given (a) loss 
l — rj and (b) distance in the absence of additional noise. The 
solid lines denote G against a beam splitting attack where 
Eve performs quadrature measurement and dashed lines 
denote G against individual beam splitting attack. Both of 
threshold xo and pulse intensity n are optimized to maximize 
G. The distance is determined by using the optical fiber loss 
coefficient 0.2dB/km for 1.55/im wavelength. 

Thus far, we have considered only the amplitude damp- 
ing of coherent states as experimental imperfections. 
Practically, noisy channel transforms an input coherent 
state into a mixture of coherent states. In the experiment 
0, the observed quadrature distributions are Gaussian. 
Therefore we consider the channel which makes the Gaus- 
sian mixture: 

^ e-^^^^'\a + l3){a + l3\d^f3, \>0. (10) 
In this case the observed phenomena for Bob is homoge- 



neous broadening of the quadrature distributions. 

If the observed quadrature distribution is Gaussian, 
Bob's information gain can be calculated by replacing 
(Aa;)^ with the observed quadrature variance (Axobs)^ 
in Eqs. |(5J and (01. However, the estimation of leaked 
information is not straightforward. In the beam split- 
ting attack, is independent of x and thus postselec- 
tion is advantageous. In general. Eve's operation makes 
correlation between Bob's measurement result x and the 
state Eve receives. In such case, depends on x and 
thus the postselection is not necessarily advantageous. In 
the next paragraph we provide an extension of individual 
beam splitting attack which preserves the postselection 
advantage. 
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FIG. 3: Eve broadens Bob's observed quadrature variance 
(Aajobs)^ by combining a beam splitter (BS) and a phase- 
insensitive amplifier (AMP). 

A lower bound of Renyi information for a given loss 
and Gaussian noise is given by considering the following 
attack: Eve performs a beam splitting with the reflec- 
tivity 1 — jU and then she operates a phase-insensitive 
amplifier [ig with the amplifier gain g > 1 (see Fig. 
fj, and g are determined by the observed variance and 
mean photon number: 



(Axobs)' = (25-l)(Ax)2, 
gfin = rjn. 



(11) 
(12) 



This implies fi — b )2+(Ax)^ ^ ^ g ^""^^ ^'^^ obtains 
more intense signal than that from individual beam split- 
ting attack. By defining the effective loss 1 — /i, the 
leaked information is estimated as the individual beam 
splitting attack: I^{n,ri,g) = I^f.{n,r]/g). In this case, 
we can still achieve G > since < < 1 and 
iAB — > 1 (a; — > 00). Therefore transmission distance is 
unlimited by this attack. 

A distance bound in the presence of excess Gaussian 
noise is given by considering the following intercept- 
resend attack: Eve performs simultaneous measurement 
using a 50:50 beam splitter followed by two homodyne 
detectors and resends a coherent state whose amplitude 
is V2 times larger than the measured value of the si- 
multaneous measurement. This operation is equal to 
continuous- variable quantum teleportation without EPR 
correlation So we refer it classical teleportation 
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FIG. 4: A distance bouri|l is shown as a function of normalized 

excess noise S — '''^^J^yi 1- Out of the gray region 5 > 2ri, 

secure key distribution is impossible. The distance is deter- 
mined by using the optical fiber loss coefficient 0.2dB/km for 
1.55/im wavelength. 



(CT). The effect of CT is summarized as the expression 
(HOI with A = 1: 

\a)^^Je-\'^\"\a + P){a + f3\d^(3. (13) 

The quadrature variance becomes 3 times larger than 
(Aa;)^ (2 is from simultaneous measurement and 1 is the 
variance of the resending coherent state). In each resend- 
ing operation, Eve knows the state Bob receives and Bob 
has no information advantage, i.e., Iab < Ie- This con- 
dition is true for any coherent state scheme because CT 



is performed for every coherent state equally. Thus co- 
herent state schemes are no longer secure if the observed 
excess noise is equal to 2(Aa;)^ or larger. 

If we introduce loss after CT, the total signal transfor- 
mation is 

\a)^ — [ e-^\^a + l3){^a + p\d^f3. (14) 
nr] J 

The observed variance is (Aiobs)^ = (1 + 2?7)(Aa::)^. The 
point is that the observed excess noise 2?7(Aa;)^ becomes 
arbitrary small for high loss. Therefore there exist loss 
limit in the presence of any finite excess noise. By defin- 
ing the normalized excess noise S = 1, a nec- 
essary condition of secure key distribution is given by 
S < 21] (see Fig^J. This limitation is practical since re- 
alization of CT is possible within today's technology. 

In conclusion, we have investigated the security of a 
continuous-variable quantum cryptographic scheme ap- 
plying a postselection against individual beam splitting 
attack and an extension of this attack in the presence 
of excess Gaussian noise. It is shown that the secure 
key gain can be positive by setting a large postselection 
threshold and in this sense the transmission distance is 
unlimited as long as these attacks are concerned. We 
have also found a loss limit by a combination of a realis- 
tic intercept-resend attack and the loss mechanism which 
reduces excess noise on quadrature distributions. The 
limitation is given for every continuous-variable scheme 
using coherent states. 
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